CVE-2026-74756

Summary

Docker Compose configurations shipped with versions prior to 3.9.1 expose the Webadmin REST API publicly without authentication by default, allowing unauthenticated remote access to sensitive administrative functions. This violates secure configuration principles and enables unauthorized actors to interact with critical system interfaces.

Exploitability

Exploitation is trivial for any remote attacker with network access to the exposed Webadmin endpoint; no authentication or user interaction is required.

Blast radius

Successful exploitation could lead to full compromise of administrative capabilities, including configuration changes, data exfiltration via API abuse, and potential lateral movement within managed infrastructure.

Detection

Defenders should monitor for unauthenticated HTTP requests (e.g., GET/POST without Authorization header) to the Webadmin REST API endpoint (typically /api/admin or similar path) from external or unexpected source IPs; repeated failed or successful requests to admin paths without prior authentication may indicate exploitation attempts.

Prioritized remediation

Upgrade to version 3.9.1 or later, which enforces random credential generation on unprotected Webadmin endpoints by default.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.